Anyone have a good resource of backdoor / spy / sketchy China computer manufacturing things?
I always see info about the Huawei scandal for example, and I would love to read a great write up of more specific technical details of things going on
I always see info about the Huawei scandal for example, and I would love to read a great write up of more specific technical details of things going on
But, you'll have an easier time finding out what companies who sell services related to supply chain integrity protection and counterfeit detection. Googling about those topics and companies like Harris Corp are good places to start. If you look at what these companies do, you should be able to infer what they are protecting against.
From what I gather, the usual threat for this sort of compromise is that adversaries in the supply chain or channel either provide or inject bogus parts or equipment. This may be done for spying purposes, but most often are just ways to make a little extra money.
The alleged difference with a state-owned entity like Huawei is that the "trusted" supply chain itself is doing untrustworthy things.
But it's not formally apart of the PRC.
Do I understand this correctly?
But the union has no control, other than after-work social activity.
It's about as complex and weird as a situation can get. Spies hide in complexity.
If the current approach is more of the same, we’ll see these reports declassified in 30 years or so, when China is (in one way or another) no longer the same looming threat it is today.
If a state actor is sufficiently motivated, even in a physical purchase, your computer will just get switched out for a bugged one at the cashier.
Common OPSEC practice re: buying hardware (or anything you don’t want your name associated with, really), is to pay an unaffiliated proxy to buy it for you.
I doubt it. How would they swap it in time if you drove to a random Best buy, picked out a laptop (I think they still keep them in locked cages on the show floor), and kept eyes on it until checkout? Nevermind that they'll need surveillance on you 24/7 and have the exact model ready to go (or be able to plant the bug within minutes) to pull this off. It's much more feasible to only bug delivered/ordered equipment.